Wireguard is broken after yesterdays apt-get dist-upgrade
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
WireGuard |
New
|
Undecided
|
Unassigned | ||
systemd |
New
|
Undecided
|
Unassigned | ||
wireguard (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned |
Bug Description
[Ubuntu server 18.04.1]
Yesterdays apt-get update && apt-get dist-upgrade broke wireguard on all systems. This is a little annoying if some of this systems are located 1600km away and the wireguard-vpn is used to reach them...
Packages relevant upgraded:
linux-image-
The wireguard-dkms was rebuilded during this upgrade, and loads into the new kernel without problems:
[ 5.038245] wireguard: loading out-of-tree module taints kernel.
[ 5.038396] wireguard: module verification failed: signature and/or required key missing - tainting kernel
[ 5.039066] wireguard: WireGuard 0.0.20191219 loaded. See www.wireguard.com for information.
[ 5.039067] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <email address hidden>. All Rights Reserved.
Wireguard is configured through systemd-networkd, the config has not changed since months. There are no errors/warnings other signs of problems regarding wireguard in any log. But Wireguard just don't transfer any data, with TCP-Dump I can see that the wireguard-server don't answer to any of the packets that are arriving from not affected clients. And affected clients are not sending out any data to the wireguard server.
One thing is eye-catching, in the output of wg on the affected devices the peers are missing:
Affected device:
interface: wg0
public key: xxx
private key: (hidden)
listening port: 443
Not affected device:
interface: wg0
public key: xxx
private key: (hidden)
listening port: 443
peer: xxx
preshared key: (hidden)
endpoint: xxx
allowed ips: xxx
transfer: 0 B received, 2.89 KiB sent
persistent keepalive: every 25 seconds
Config of one device:
30-wg0.netdev:
[NetDev]
Name = wg0
Kind = wireguard
Description = Wireguard
[WireGuard]
PrivateKey = xxx
# PublicKey = xxx
ListenPort = xxx
[WireGuardPeer]
PublicKey = xxx
PresharedKey = xxx
AllowedIPs = xxx
Endpoint = xxx
PersistentKeepalive = 25
30-wg0.network:
[Match]
Name = wg0
[Link]
MTUBytes=1300
[Network]
DNS = xxx
DNS = xxx
Domains=xxx
[Address]
Address = xxx
[Address]
Address = xxx
[Route]
Gateway = xxx
Destination = xxx
Metric=50000
Full List of Packages updated:
Start-Date: 2020-01-17 14:40:50
Commandline: /usr/bin/apt-get -y -o Dpkg::Options:
Install: linux-image-
Upgrade: php7.2-bz2:amd64 (7.2.24-
End-Date: 2020-01-17 14:46:41
description: | updated |
affects: | ubuntu → wireguard (Ubuntu) |
tags: | added: bionic |
Update: If I build a config with my data to according to the wg manpage and pass it to wg setconf, I See the peers again with wg. So, maybe it is a problem between systemd-networkd and the new 5.3 kernel?